Prepare the reference server
(this is done once, but needs to be maintained)

Create a reference vserver installation

Our reference will be called called zunzuncito (smallest bird in the world perso.wanadoo.es/ferminia/Image41.jpg), using the script provided here:
www.paul.sladen.org/vserver/debian/debian-newvserver.sh

Note, I hackishly modified this to work with testing/sarge, which required that we install the testing version of debootstrap and did not go smoothly, I had to massage things by hand to get it to work. I wanted to create a testing vserver as our reference server so that our vservers could have testing packages, but the host server remains the stable woody.

# newvserver --hostname zunzuncito --domain riseup.net --ip 69.90.134.161 --mirror http://gerund.linuxfund.org:9999/debian/

Enter the reference server and install a package

(networking has to work first)

host# vserver zunzuncito exec bash
zunzuncito# apt-get install apache apache-common 

Make sure that every file has Immutable Link Invert set

This is NOT the same as immutable. This is a special patch which changes the behavior of +it.

To make the reference so that the instances cannot modify it:

host# vserver zun stop
host# cd /vservers/zun
host# find . -path './tmp' -prune -o -path './var' -prune -o -xdev -type f -exec chattr +it \{\} \;

of course, once you upgrade packages, then those attributes will be lost and you need to do it again.